JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged… (CVE-2026-108654)

CVE-2026-108654 describes a missing authorization vulnerability in JeecgBoot through version 3.9.5. Specifically, the OssFileController's queryById handler does not properly enforce authorization checks, enabling authenticated users with low privileges to retrieve file metadata and storage URLs for files uploaded by other users if they know the record ID. This vulnerability impacts confidentiality but does not affect integrity or availability.

The vulnerability allows unauthorized disclosure of file metadata and storage URLs, potentially exposing sensitive information about files stored by other users. However, it does not allow modification or deletion of files, nor does it impact system availability. The CVSS 3.1 base score is 4.3 (medium severity), reflecting the limited scope of confidentiality impact.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the OssFileController queryById endpoint to authorized users only or implement additional access control checks to prevent unauthorized file metadata disclosure.